summaryrefslogtreecommitdiffstats
path: root/qemu/scripts/coverity-model.c
blob: 617f67d716914a737999c11b546ca77d1c5ba7a7 (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
/* Coverity Scan model
 *
 * Copyright (C) 2014 Red Hat, Inc.
 *
 * Authors:
 *  Markus Armbruster <armbru@redhat.com>
 *  Paolo Bonzini <pbonzini@redhat.com>
 *
 * This work is licensed under the terms of the GNU GPL, version 2 or, at your
 * option, any later version.  See the COPYING file in the top-level directory.
 */


/*
 * This is the source code for our Coverity user model file.  The
 * purpose of user models is to increase scanning accuracy by explaining
 * code Coverity can't see (out of tree libraries) or doesn't
 * sufficiently understand.  Better accuracy means both fewer false
 * positives and more true defects.  Memory leaks in particular.
 *
 * - A model file can't import any header files.  Some built-in primitives are
 *   available but not wchar_t, NULL etc.
 * - Modeling doesn't need full structs and typedefs. Rudimentary structs
 *   and similar types are sufficient.
 * - An uninitialized local variable signifies that the variable could be
 *   any value.
 *
 * The model file must be uploaded by an admin in the analysis settings of
 * http://scan.coverity.com/projects/378
 */

#define NULL ((void *)0)

typedef unsigned char uint8_t;
typedef char int8_t;
typedef unsigned int uint32_t;
typedef int int32_t;
typedef long ssize_t;
typedef unsigned long long uint64_t;
typedef long long int64_t;
typedef _Bool bool;

typedef struct va_list_str *va_list;

/* exec.c */

typedef struct AddressSpace AddressSpace;
typedef uint64_t hwaddr;
typedef uint32_t MemTxResult;
typedef uint64_t MemTxAttrs;

static void __bufwrite(uint8_t *buf, ssize_t len)
{
    int first, last;
    __coverity_negative_sink__(len);
    if (len == 0) return;
    buf[0] = first;
    buf[len-1] = last;
    __coverity_writeall__(buf);
}

static void __bufread(uint8_t *buf, ssize_t len)
{
    __coverity_negative_sink__(len);
    if (len == 0) return;
    int first = buf[0];
    int last = buf[len-1];
}

MemTxResult address_space_rw(AddressSpace *as, hwaddr addr, MemTxAttrs attrs,
                             uint8_t *buf, int len, bool is_write)
{
    MemTxResult result;

    // TODO: investigate impact of treating reads as producing
    // tainted data, with __coverity_tainted_data_argument__(buf).
    if (is_write) __bufread(buf, len); else __bufwrite(buf, len);

    return result;
}

/* Tainting */

typedef struct {} name2keysym_t;
static int get_keysym(const name2keysym_t *table,
                      const char *name)
{
    int result;
    if (result > 0) {
        __coverity_tainted_string_sanitize_content__(name);
        return result;
    } else {
        return 0;
    }
}

/*
 * GLib memory allocation functions.
 *
 * Note that we ignore the fact that g_malloc of 0 bytes returns NULL,
 * and g_realloc of 0 bytes frees the pointer.
 *
 * Modeling this would result in Coverity flagging a lot of memory
 * allocations as potentially returning NULL, and asking us to check
 * whether the result of the allocation is NULL or not.  However, the
 * resulting pointer should never be dereferenced anyway, and in fact
 * it is not in the vast majority of cases.
 *
 * If a dereference did happen, this would suppress a defect report
 * for an actual null pointer dereference.  But it's too unlikely to
 * be worth wading through the false positives, and with some luck
 * we'll get a buffer overflow reported anyway.
 */

/*
 * Allocation primitives, cannot return NULL
 * See also Coverity's library/generic/libc/all/all.c
 */

void *g_malloc_n(size_t nmemb, size_t size)
{
    size_t sz;
    void *ptr;

    __coverity_negative_sink__(nmemb);
    __coverity_negative_sink__(size);
    sz = nmemb * size;
    ptr = __coverity_alloc__(sz);
    __coverity_mark_as_uninitialized_buffer__(ptr);
    __coverity_mark_as_afm_allocated__(ptr, "g_free");
    return ptr;
}

void *g_malloc0_n(size_t nmemb, size_t size)
{
    size_t sz;
    void *ptr;

    __coverity_negative_sink__(nmemb);
    __coverity_negative_sink__(size);
    sz = nmemb * size;
    ptr = __coverity_alloc__(sz);
    __coverity_writeall0__(ptr);
    __coverity_mark_as_afm_allocated__(ptr, "g_free");
    return ptr;
}

void *g_realloc_n(void *ptr, size_t nmemb, size_t size)
{
    size_t sz;

    __coverity_negative_sink__(nmemb);
    __coverity_negative_sink__(size);
    sz = nmemb * size;
    __coverity_escape__(ptr);
    ptr = __coverity_alloc__(sz);
    /*
     * Memory beyond the old size isn't actually initialized.  Can't
     * model that.  See Coverity's realloc() model
     */
    __coverity_writeall__(ptr);
    __coverity_mark_as_afm_allocated__(ptr, "g_free");
    return ptr;
}

void g_free(void *ptr)
{
    __coverity_free__(ptr);
    __coverity_mark_as_afm_freed__(ptr, "g_free");
}

/*
 * Derive the g_try_FOO_n() from the g_FOO_n() by adding indeterminate
 * out of memory conditions
 */

void *g_try_malloc_n(size_t nmemb, size_t size)
{
    int nomem;

    if (nomem) {
        return NULL;
    }
    return g_malloc_n(nmemb, size);
}

void *g_try_malloc0_n(size_t nmemb, size_t size)
{
    int nomem;

    if (nomem) {
        return NULL;
    }
    return g_malloc0_n(nmemb, size);
}

void *g_try_realloc_n(void *ptr, size_t nmemb, size_t size)
{
    int nomem;

    if (nomem) {
        return NULL;
    }
    return g_realloc_n(ptr, nmemb, size);
}

/* Trivially derive the g_FOO() from the g_FOO_n() */

void *g_malloc(size_t size)
{
    return g_malloc_n(1, size);
}

void *g_malloc0(size_t size)
{
    return g_malloc0_n(1, size);
}

void *g_realloc(void *ptr, size_t size)
{
    return g_realloc_n(ptr, 1, size);
}

void *g_try_malloc(size_t size)
{
    return g_try_malloc_n(1, size);
}

void *g_try_malloc0(size_t size)
{
    return g_try_malloc0_n(1, size);
}

void *g_try_realloc(void *ptr, size_t size)
{
    return g_try_realloc_n(ptr, 1, size);
}

/*
 * GLib string allocation functions
 */

char *g_strdup(const char *s)
{
    char *dup;
    size_t i;

    if (!s) {
        return NULL;
    }

    __coverity_string_null_sink__(s);
    __coverity_string_size_sink__(s);
    dup = __coverity_alloc_nosize__();
    __coverity_mark_as_afm_allocated__(dup, "g_free");
    for (i = 0; (dup[i] = s[i]); i++) ;
    return dup;
}

char *g_strndup(const char *s, size_t n)
{
    char *dup;
    size_t i;

    __coverity_negative_sink__(n);

    if (!s) {
        return NULL;
    }

    dup = g_malloc(n + 1);
    for (i = 0; i < n && (dup[i] = s[i]); i++) ;
    dup[i] = 0;
    return dup;
}

char *g_strdup_printf(const char *format, ...)
{
    char ch, *s;
    size_t len;

    __coverity_string_null_sink__(format);
    __coverity_string_size_sink__(format);

    ch = *format;

    s = __coverity_alloc_nosize__();
    __coverity_writeall__(s);
    __coverity_mark_as_afm_allocated__(s, "g_free");
    return s;
}

char *g_strdup_vprintf(const char *format, va_list ap)
{
    char ch, *s;
    size_t len;

    __coverity_string_null_sink__(format);
    __coverity_string_size_sink__(format);

    ch = *format;
    ch = *(char *)ap;

    s = __coverity_alloc_nosize__();
    __coverity_writeall__(s);
    __coverity_mark_as_afm_allocated__(s, "g_free");

    return len;
}

char *g_strconcat(const char *s, ...)
{
    char *s;

    /*
     * Can't model: last argument must be null, the others
     * null-terminated strings
     */

    s = __coverity_alloc_nosize__();
    __coverity_writeall__(s);
    __coverity_mark_as_afm_allocated__(s, "g_free");
    return s;
}

/* Other glib functions */

typedef struct _GIOChannel GIOChannel;
GIOChannel *g_io_channel_unix_new(int fd)
{
    GIOChannel *c = g_malloc0(sizeof(GIOChannel));
    __coverity_escape__(fd);
    return c;
}

void g_assertion_message_expr(const char     *domain,
                              const char     *file,
                              int             line,
                              const char     *func,
                              const char     *expr)
{
    __coverity_panic__();
}